detection.wiki

Detection rules › Sigma

OCSP responder auditing settings changed or disabled

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker would attempt to alter or disable OCSP responder auditing settings to evade detection and perform further escalation via ADCS vulnerabilities.

MITRE ATT&CK coverage

TacticTechniques
StealthT1562.002 Impair Defenses: Disable Windows Event Logging

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 5123A configuration entry changed in the OCSP Responder Service.

Rule body yaml

title: OCSP responder auditing settings changed or disabled
description: Detects scenarios where an attacker would attempt to alter or disable OCSP responder auditing settings to evade detection and perform further escalation via ADCS vulnerabilities.
requirements: requires to have the OCSP role installed and to have enabled auditing in the responder properties.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1222.001-File%20and%20Directory%20Permissions%20Modification
- https://www.gradenegger.eu/en/overview-of-the-audit-events-generated-by-the-online-responder-ocsp/
- https://services.google.com/fh/files/misc/active-directory-certificate-services-hardening-wp-en.pdf
- https://speakerdeck.com/heirhabarov/hunting-for-active-directory-certificate-services-abuse
- https://www.crowdstrike.com/wp-content/uploads/2023/12/investigating-active-directory-certificate-abuse.pdf
tags:
- attack.defense_evasion
- attack.t1562.002 # Impair Defenses: Disable or Modify Tools 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5123
    PropertyName: AuditFilter
  condition: selection
falsepositives:
- Rare PKI/ADCS/OSCP admin changes
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 5123
  PropertyName: AuditFilter

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
PropertyNameeq
  • AuditFilter